---
typeId: req
recordId: benac-inv-005
fields:
  title: No silent fallback
  statement: >-
    Benac shall not silently change package, package interface, descriptor, descriptor
    scope, request schema, descriptor config schema, output schema, invocation contract,
    storage source, compute source, trust scope, capability scope, cryptographic
    profile, identity binding, encryption policy, privacy policy, output contract, data
    class, schema ruleset, resource policy, or security behavior.

    Any fallback, substitution, or policy-selected alternative shall require explicit
    authority and shall be recorded in the invocation trace or related audit record.

    Benac shall not silently switch from a requested package interface to another
    package interface.

    Benac shall not silently switch from a requested descriptor scope to another
    descriptor scope.

    Benac shall not silently change requested capability scope or data class.

    When a requested package interface or invocation contract cannot currently be
    attempted, Benac shall record the reason and shall fail closed unless explicit
    fallback policy authorizes another interface or contract.
  rationale: >-
    Silent fallback destroys the feedback loop. Agents and users need to know which
    package interface, descriptor, policy, contract, schema, data class, and authority
    were actually used so they can trust, debug, or revise the next attempt.
  verification: >-
    A requested package interface records skipped or blocked reason and fails unless
    fallback policy permits another interface. Verification shows that a caller-requested
    interface does not silently fall back to another interface and that fallback reasons
    are recorded when explicit fallback is allowed.
  testable: true
  status: draft
  area: BENAC-INV
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Invocation, evidence, effects, audit, and tamper-evidence
  order: 109
---
